Feature/#216 output allfields csvnewcolumn (#469)

* refactoring * refactoring * under constructing * underconstructing * under construction * underconstructing * fix existing testcase * finish implement * fmt * add option * change name * fix control code bug * fix disp * change format and fix testcase * fix help
Yamato-Security · Apr 8, 2022 · 7d37e07 · 7d37e07
1 parent d6efb51
commit 7d37e07
Show file tree

Hide file tree

Showing 5 changed files with 288 additions and 118 deletions.
diff --git a/src/afterfact.rs b/src/afterfact.rs
@@ -21,9 +21,11 @@ pub struct CsvFormat<'a> {
     computer: &'a str,
     event_i_d: &'a str,
     level: &'a str,
+    mitre_attack: &'a str,
     rule_title: &'a str,
     details: &'a str,
-    mitre_attack: &'a str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    record_information: Option<&'a str>,
     rule_path: &'a str,
     file_path: &'a str,
 }
@@ -37,6 +39,8 @@ pub struct DisplayFormat<'a> {
     pub level: &'a str,
     pub rule_title: &'a str,
     pub details: &'a str,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub record_information: Option<&'a str>,
 }
 
 /// level_color.txtファイルを読み込み対応する文字色のマッピングを返却する関数
@@ -139,88 +143,44 @@ fn emit_csv<W: std::io::Write>(
     for (time, detect_infos) in messages.iter() {
         for detect_info in detect_infos {
             if displayflag {
-                if color_map.is_some() {
-                    let output_color =
-                        _get_output_color(color_map.as_ref().unwrap(), &detect_info.level);
-                    wtr.serialize(DisplayFormat {
-                        timestamp: &format!(
-                            "{} ",
-                            &format_time(time).truecolor(
-                                output_color[0],
-                                output_color[1],
-                                output_color[2]
-                            )
-                        ),
-                        level: &format!(
-                            " {} ",
-                            &detect_info.level.truecolor(
-                                output_color[0],
-                                output_color[1],
-                                output_color[2]
-                            )
-                        ),
-                        computer: &format!(
-                            " {} ",
-                            &detect_info.computername.truecolor(
-                                output_color[0],
-                                output_color[1],
-                                output_color[2]
-                            )
-                        ),
-                        event_i_d: &format!(
-                            " {} ",
-                            &detect_info.eventid.truecolor(
-                                output_color[0],
-                                output_color[1],
-                                output_color[2]
-                            )
-                        ),
-                        rule_title: &format!(
-                            " {} ",
-                            &detect_info.alert.truecolor(
-                                output_color[0],
-                                output_color[1],
-                                output_color[2]
-                            )
-                        ),
-                        details: &format!(
-                            " {}",
-                            &detect_info.detail.truecolor(
-                                output_color[0],
-                                output_color[1],
-                                output_color[2]
-                            )
-                        ),
-                    })?;
-                } else {
-                    wtr.serialize(DisplayFormat {
-                        timestamp: &format!("{} ", &format_time(time)),
-                        level: &format!(" {} ", &detect_info.level),
-                        computer: &format!(" {} ", &detect_info.computername),
-                        event_i_d: &format!(" {} ", &detect_info.eventid),
-                        rule_title: &format!(" {} ", &detect_info.alert),
-                        details: &format!(
-                            " {}",
-                            &detect_info
-                                .detail
-                                .chars()
-                                .filter(|&c| !c.is_control())
-                                .collect::<String>()
-                        ),
-                    })?;
-                }
+                let colors = color_map
+                    .as_ref()
+                    .map(|cl_mp| _get_output_color(cl_mp, &detect_info.level));
+                let colors = colors.as_ref();
+
+                let recinfo = detect_info
+                    .record_information
+                    .as_ref()
+                    .map(|recinfo| _format_cell(recinfo, ColPos::Last, colors));
+                let details = detect_info
+                    .detail
+                    .chars()
+                    .filter(|&c| !c.is_control())
+                    .collect::<String>();
+
+                let dispformat = DisplayFormat {
+                    timestamp: &_format_cell(&format_time(time), ColPos::First, colors),
+                    level: &_format_cell(&detect_info.level, ColPos::Other, colors),
+                    computer: &_format_cell(&detect_info.computername, ColPos::Other, colors),
+                    event_i_d: &_format_cell(&detect_info.eventid, ColPos::Other, colors),
+                    rule_title: &_format_cell(&detect_info.alert, ColPos::Other, colors),
+                    details: &_format_cell(&details, ColPos::Other, colors),
+                    record_information: recinfo.as_deref(),
+                };
+                wtr.serialize(dispformat)?;
             } else {
                 // csv出力時フォーマット
                 wtr.serialize(CsvFormat {
                     timestamp: &format_time(time),
-                    file_path: &detect_info.filepath,
-                    rule_path: &detect_info.rulepath,
                     level: &detect_info.level,
                     computer: &detect_info.computername,
                     event_i_d: &detect_info.eventid,
+                    mitre_attack: &detect_info.tag_info,
                     rule_title: &detect_info.alert,
                     details: &detect_info.detail,
-                    mitre_attack: &detect_info.tag_info,
+                    record_information: detect_info.record_information.as_deref(),
+                    file_path: &detect_info.filepath,
+                    rule_path: &detect_info.rulepath,
                 })?;
             }
             let level_suffix = *configs::LEVELMAP
@@ -252,6 +212,29 @@ fn emit_csv<W: std::io::Write>(
     Ok(())
 }
 
+enum ColPos {
+    First, // 先頭
+    Last,  // 最後
+    Other, // それ以外
+}
+
+fn _format_cellpos(column: ColPos, colval: &str) -> String {
+    return match column {
+        ColPos::First => format!("{} ", colval),
+        ColPos::Last => format!(" {}", colval),
+        ColPos::Other => format!(" {} ", colval),
+    };
+}
+
+fn _format_cell(word: &str, column: ColPos, output_color: Option<&Vec<u8>>) -> String {
+    if let Some(color) = output_color {
+        let colval = format!("{}", word.truecolor(color[0], color[1], color[2]));
+        _format_cellpos(column, &colval)
+    } else {
+        _format_cellpos(column, word)
+    }
+}
+
 /// 与えられたユニークな検知数と全体の検知数の情報(レベル別と総計)を元に結果文を標準出力に表示する関数
 fn _print_unique_results(
     mut counts_by_level: Vec<u128>,
@@ -358,6 +341,7 @@ mod tests {
         let test_eventid = "1111";
         let output = "pokepoke";
         let test_attack = "execution/txxxx.yyy";
+        let test_recinfo = "record_infoinfo11";
         {
             let mut messages = print::MESSAGES.lock().unwrap();
             messages.clear();
@@ -388,6 +372,7 @@ mod tests {
                     alert: test_title.to_string(),
                     detail: String::default(),
                     tag_info: test_attack.to_string(),
+                    record_information: Option::Some(test_recinfo.to_string()),
                 },
             );
         }
@@ -396,7 +381,7 @@ mod tests {
             .unwrap();
         let expect_tz = expect_time.with_timezone(&Local);
         let expect =
-            "Timestamp,Computer,EventID,Level,RuleTitle,Details,MitreAttack,RulePath,FilePath\n"
+            "Timestamp,Computer,EventID,Level,MitreAttack,RuleTitle,Details,RecordInformation,RulePath,FilePath\n"
                 .to_string()
                 + &expect_tz
                     .clone()
@@ -409,11 +394,13 @@ mod tests {
                 + ","
                 + test_level
                 + ","
+                + test_attack
+                + ","
                 + test_title
                 + ","
                 + output
                 + ","
-                + test_attack
+                + test_recinfo
                 + ","
                 + testrulepath
                 + ","
@@ -470,6 +457,7 @@ mod tests {
                     alert: test_title.to_string(),
                     detail: String::default(),
                     tag_info: test_attack.to_string(),
+                    record_information: Option::Some(String::default()),
                 },
             );
             messages.debug();
@@ -478,7 +466,8 @@ mod tests {
             .datetime_from_str("1996-02-27T01:05:01Z", "%Y-%m-%dT%H:%M:%SZ")
             .unwrap();
         let expect_tz = expect_time.with_timezone(&Local);
-        let expect_header = "Timestamp|Computer|EventID|Level|RuleTitle|Details\n";
+        let expect_header =
+            "Timestamp|Computer|EventID|Level|RuleTitle|Details|RecordInformation\n";
         let expect_colored = expect_header.to_string()
             + &get_white_color_string(
                 &expect_tz
@@ -496,6 +485,8 @@ mod tests {
             + &get_white_color_string(test_title)
             + " | "
             + &get_white_color_string(output)
+            + " | "
+            + &get_white_color_string("")
             + "\n";
         let expect_nocoloed = expect_header.to_string()
             + &expect_tz
@@ -512,6 +503,8 @@ mod tests {
             + test_title
             + " | "
             + output
+            + " | "
+            + ""
             + "\n";
 
         let mut file: Box<dyn io::Write> =

diff --git a/src/detections/configs.rs b/src/detections/configs.rs
@@ -69,6 +69,7 @@ fn build_app<'a>() -> ArgMatches<'a> {
 
     let usages = "-d --directory=[DIRECTORY] 'Directory of multiple .evtx files.'
     -f --filepath=[FILEPATH] 'File path to one .evtx file.'
+    -F --full-data 'Print all field information.'
     -r --rules=[RULEDIRECTORY/RULEFILE] 'Rule file or directory (default: ./rules)'
     -c --color 'Output with color. (Terminal needs to support True Color.)'
     -C --config=[RULECONFIGDIRECTORY] 'Rule config folder. (Default: ./rules/config)'

diff --git a/src/detections/detection.rs b/src/detections/detection.rs
@@ -32,6 +32,7 @@ pub struct EvtxRecordInfo {
     pub record: Value,         // 1レコード分のデータをJSON形式にシリアライズしたもの
     pub data_string: String,
     pub key_2_value: hashbrown::HashMap<String, String>,
+    pub record_information: Option<String>,
 }
 
 impl EvtxRecordInfo {
@@ -204,24 +205,29 @@ impl Detection {
             .filter_map(|info| TAGS_CONFIG.get(info.as_str().unwrap_or(&String::default())))
             .map(|str| str.to_owned())
             .collect();
+
+        let recinfo = record_info
+            .record_information
+            .as_ref()
+            .map(|recinfo| recinfo.to_string());
+        let detect_info = DetectInfo {
+            filepath: record_info.evtx_filepath.to_string(),
+            rulepath: rule.rulepath.to_string(),
+            level: rule.yaml["level"].as_str().unwrap_or("-").to_string(),
+            computername: record_info.record["Event"]["System"]["Computer"]
+                .to_string()
+                .replace('\"', ""),
+            eventid: get_serde_number_to_string(&record_info.record["Event"]["System"]["EventID"])
+                .unwrap_or_else(|| "-".to_owned()),
+            alert: rule.yaml["title"].as_str().unwrap_or("").to_string(),
+            detail: String::default(),
+            tag_info: tag_info.join(" | "),
+            record_information: recinfo,
+        };
         MESSAGES.lock().unwrap().insert(
             &record_info.record,
             rule.yaml["details"].as_str().unwrap_or("").to_string(),
-            DetectInfo {
-                filepath: record_info.evtx_filepath.to_string(),
-                rulepath: rule.rulepath.to_string(),
-                level: rule.yaml["level"].as_str().unwrap_or("-").to_string(),
-                computername: record_info.record["Event"]["System"]["Computer"]
-                    .to_string()
-                    .replace('\"', ""),
-                eventid: get_serde_number_to_string(
-                    &record_info.record["Event"]["System"]["EventID"],
-                )
-                .unwrap_or_else(|| "-".to_owned()),
-                alert: rule.yaml["title"].as_str().unwrap_or("").to_string(),
-                detail: String::default(),
-                tag_info: tag_info.join(" | "),
-            },
+            detect_info,
         );
     }
 
@@ -234,19 +240,27 @@ impl Detection {
             .map(|info| info.as_str().unwrap_or("").replace("attack.", ""))
             .collect();
         let output = Detection::create_count_output(rule, &agg_result);
-        MESSAGES.lock().unwrap().insert_message(
-            DetectInfo {
-                filepath: "-".to_owned(),
-                rulepath: rule.rulepath.to_owned(),
-                level: rule.yaml["level"].as_str().unwrap_or("").to_owned(),
-                computername: "-".to_owned(),
-                eventid: "-".to_owned(),
-                alert: rule.yaml["title"].as_str().unwrap_or("").to_owned(),
-                detail: output,
-                tag_info: tag_info.join(" : "),
-            },
-            agg_result.start_timedate,
-        )
+        let rec_info = if configs::CONFIG.read().unwrap().args.is_present("full-data") {
+            Option::Some(String::default())
+        } else {
+            Option::None
+        };
+        let detect_info = DetectInfo {
+            filepath: "-".to_owned(),
+            rulepath: rule.rulepath.to_owned(),
+            level: rule.yaml["level"].as_str().unwrap_or("").to_owned(),
+            computername: "-".to_owned(),
+            eventid: "-".to_owned(),
+            alert: rule.yaml["title"].as_str().unwrap_or("").to_owned(),
+            detail: output,
+            record_information: rec_info,
+            tag_info: tag_info.join(" : "),
+        };
+
+        MESSAGES
+            .lock()
+            .unwrap()
+            .insert_message(detect_info, agg_result.start_timedate)
     }
 
     ///aggregation conditionのcount部分の検知出力文の文字列を返す関数
@@ -509,4 +523,7 @@ mod tests {
             expected_output
         );
     }
+
+    #[test]
+    fn test_create_fields_value() {}
 }